CVE-2026-17084
stringprep.map_table_b2() deviates from RFC 3454 Table B.2
Description
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
No summary for this CVE yet.
Weaknesses
Affected Products
Python Software Foundation
oss-project·USaka psf
Exploitability
No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.
References
https://github.com/python/cpython/pull/155293
github.com
https://github.com/python/cpython/issues/155292
github.com
https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
mail.python.org
and 7 more references View all →
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-17084 and every CVE in our database. Create a free account — no credit card required.
Create Free AccountPlain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows